General-purpose AI tools may be used to support the following activities, provided that such use complies with these guidelines:

• Ideation and analysis

• Coding

• Testing (e.g. unit tests, integration tests, end-to-end (E2E) tests, load and performance testing, and security testing)

• Design and architecture

• Project management and documentation

• Content creation

Use of artificial intelligence for activities other than those listed above requires prior approval from Digital Iceland. Examples of such activities include:

• Implementation of embedded artificial intelligence as part of a project deliverable

• Integration of external AI solutions (e.g. AI agents) with Digital Iceland systems

AI tools used must meet quality and security requirements in accordance with Digital Iceland’s quality policy and information security policies.

If there is any uncertainty regarding whether the use of artificial intelligence is permitted under these guidelines, or due to security or ethical considerations, approval must be obtained from Digital Iceland.

The following information must not be entered into public or external AI tools:

• Sensitive personal data as defined by data protection legislation

• Data from development environments (e.g. API keys, configuration variables, secrets, logs, etc.)

• Confidential information or unpublished material

• Information from service systems or case management systems

• Any other information that may contain personally identifiable information (PII)

In particular, it is strictly prohibited to copy or input real user data, national identification numbers, user requests, or code containing live connections to systems when performing debugging, support, or analysis.

Synthetic or mock data may be used, provided that it cannot be traced back to real individuals or cases.

Digital Iceland may request further information regarding the use of artificial intelligence during the contract period, including:

• Whether and how artificial intelligence is used

• For what purpose it is used

• How benefits and impact are assessed

• How quality assurance and review are conducted

The use of artificial intelligence does not change accountability.

• The developer remains fully responsible for the quality, security, and correct functionality of the deliverable.

• All code and content produced with the assistance of artificial intelligence must undergo standard review (e.g. code review) by the responsible party before being released.

• The code owner is responsible for reviewing and approving changes, including those created with the assistance of artificial intelligence (see Code Owners).

• All pull requests must be submitted by a human, not by artificial intelligence.

• Where artificial intelligence has been used, this should be indicated in the pull request, for example through labeling or in the description.

Artificial intelligence tools must not be used as a substitute for professional judgment or security assessment.

The use of artificial intelligence must always comply with:

• Data protection laws

• Digital Iceland’s information security policy

• Applicable service agreements

• The Icelandic government’s data classification framework

• Public sector guidelines on artificial intelligence

• Other contractual requirements

The use of AI tools in work performed for Digital Iceland is the responsibility of the developer and is considered part of their general operating costs.

Digital Iceland does not cover costs related to subscriptions or other fees associated with the use of AI tools in software development, unless otherwise agreed in advance.

Accordingly, no separate claims for payment may be made for the use of artificial intelligence in development, testing, analysis, or other work related to Digital Iceland projects.